Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Inconclusive .Net Framework update

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Open Discussions

This thread has been marked as locked.
TiMow Inconclusive .Net Framework update
Dedicated Contributor 5th Oct, 2010 09:47
Ranking: 737
Posts: 728
User Since: 26th Jun, 2009
System Score: N/A
Location: CH
Last edited on 5th Oct, 2010 09:52

XP Pro SP3; PSI 1.5.0.2.

Current installed instances of .Net Framework, as listed under PSI Patched tab:

Microsoft .NET Framework 1.x 1.0.3705.6073
Microsoft .NET Framework 1.x 1.1.4322.2470
Microsoft .NET Framework 2.x 2.0.50727.3618
Microsoft .NET Framework 3.x 3.0.4506.2152


[N.B.: .Net Framework 3.5x (SP1) is listed under add/remove, but not listed under patched; and 2 instances of . Net Framework 4.x (KB982670 and KB982671) are offered as optional under M$ update Custom, but not installed.]

Having seen others' problems with .Net Framework, I ran a scan which listed all 4 examples above as insecure. M$ update offered 3 KB downloads.

Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2416447)

Security Update for Microsoft .NET Framework 2.0 SP2 and 3.5 SP1 on Windows Server 2003 and Windows XP x86 (KB2418241)

Security Update for Microsoft .NET Framework 3.5 SP1 on Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 x86 (KB2416473)


All downloaded fine, but on start of installation, the progress bar stopped/froze at about 25% complete - after many minutes of seemingly no progress bar movement, I clicked cancel and then red X - neither of which closed the download/installation window.

Before finally closing this window (from Task Mgr.), the following was shown:

Downloading Security Update for Microsoft .NET Framework 2.0 SP2 and 3.5 SP1 on Windows Server 2003 and Windows XP x86 (KB2418241) (update 1 of 3)... done!
Downloading Security Update for Microsoft .NET Framework 3.5 SP1 on Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 x86 (KB2416473) (update 2 of 3)... done!
Downloading Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2416447) (update 3 of 3)... done!
Initializing installation... done!
Installing Security Update for Microsoft .NET Framework 2.0 SP2 and 3.5 SP1 on Windows Server 2003 and Windows XP x86 (KB2418241) (update 1 of 3)...


At this point, a second update shield appeared in the taskbar tray, with the following:

The following updates were not installed:

Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2416447)
Security Update for Microsoft .NET Framework 2.0 SP2 and 3.5 SP1 on Windows Server 2003 and Windows XP x86 (KB2418241)
Security Update for Microsoft .NET Framework 3.5 SP1 on Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 x86 (KB2416473)


However when Task Mgr. closed the "stuck" window, both shields disappeared.

[Next time I opened IE, I got the pop-up about IE terminating unexpectantly, and resume session went to M$ update.]

M$ Update history lists:
- (KB2416473) as green tick (succeeded); source: Auto Update;
- (KB2416447) same as above;
- (KB2418241) as red cross plus "?" (failed - error code: 0x800706BE ); source: M$ Update;
- (KB2416473) (again!) as cancelled; source: M$ Update

all dated the same (4.10)

All 3 KB updates appear in add/remove, but (KB2418241) only appears under .Net 2.x SP2 and not .Net 3.5 SP1.

After re-boot and PSI re-scan, insecurities have been cleared and again appear in patched, with 100% score.

Therefore (finally):- is there a problem with with M$ update? - it appears that 2 KB's were installed with Auto Update, which was initiated only when manual update was run - possibly causing the installation to freeze;
and secondly, is (KB2418241) correctly and completely installed for both . Net 2.x and .Net 3.5.x? If not how will an incomplete installation manifest itself/effect the running of my computer, and how will I be aware of any problems?

N.B. M$ Update now lists no High Priority updates.


--
Computing is not yet a perfect science - it still requires humans.

Maurice Joyce RE: Inconclusive .Net Framework update
Handling Contributor 5th Oct, 2010 10:13
Score: 11726
Posts: 8,970
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@TiMow
Thank U for the detailed instructions of what is happening to some. As U know I am dealing with 2 instances on the Forum & @Mogs is running with 2.

I have ruled out the PSI/XP bug or any false positive from Secunia.

It is highly unlikely it is anything to do with MS. The instances reported on the Forum of it not installing correctly are too small. I have installed it on all 3 major OS's & it went on like a dream without a reboot.

I am also convinced it is not a corruption within .Net that would require the tricky procedure of uninstalling all .Net & starting again.

I also note U have not got Version 4 installed. Very wise - I am on record on this Forum as advising not to install it. The chances of it being required by a home user in the near future are very slim.

I am coming around to the idea that it is this update that may be causing the problem:

http://www.microsoft.com/downloads/en/details.aspx...

Still testing but it is slowly slowly with .Net - it can be troublesome & in some instances crippling for the OS.

Again, thanks for the detail. It gives me something else to look into.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0
TiMow RE: Inconclusive .Net Framework update
Dedicated Contributor 5th Oct, 2010 15:01
Score: 737
Posts: 728
User Since: 26th Jun 2009
System Score: N/A
Location: CH
@MJ

I wasn't sure if my above info. would be relevant to others' problems, and therefore created a new thread, and not tagged on.

Useful that you re-affirmed the lack of requirement for .Net 4.x - will leave that alone.

I'm also unsure, as to whether the possible problem update link (in your reply above) relates to me or not? - I'm guessing not, in my case.

Some additional points/info./Q.'s:

- I'm almost certain the installation of the updates froze (the indicator circle had also stopped - as well as the progress bar), but cannot rule out a slight pre-empting of such, by myself, as I was observing the progress this time, whereas normally I don't - I hope it wasn't impatience.

- I chose Microsoft .NET Framework 2.x 2.0.50727.3618 to click download solution update link first (although it wouldn't matter which I chose), as I knew I wasn't current (showing .3614) - KB2418241 offers the fix. After Task Mgr. closed the "stuck" installation window, PSI now indicated 3 insecurities (without re-boot).
Unfortunately, I didn't record exactly which one had been fixed, at this point, from the 3 remaining insecurities. Then re-booted and re-scanned, which now cleared these.

- The 2 M$ update shields (in tray), is still confusing, especially as the second purported to non-installation of the 3 KB's, despite "assumed" evidence to the contrary elsewhere.

- Why would (in update history) KB2416473 and KB2416447 be shown as Auto updated, when I instigated a manual update?

- It is KB2418241 which shows as "failed" on my update history, despite it being listed in add/remove (only under .Net 2.x), and the previous insecure instance now showing as patched - should the same KB also be listed under .Net 3.5.x (add/remove), as it seems to apply to that also? Is that why the update history indicates "failed" , then "?" - or does the one listing, under 2.x. elude to correct installation?

- Would it be apparent, under normal daily use, if there was an installation problem (especially relating to .Net 3.5.x.)? - I saw your "FixIt" link on another thread, and assume that I don't need to run this (?).

- Should .Net 3.5.x be listed under PSI patched, with the others?

- Or, finally, is it a case of: "If it ain't broke ... "

Regards

TiMow

--
Computing is not yet a perfect science - it still requires humans.
Was this reply relevant?
+1
-0
Anthony Wells RE: Inconclusive .Net Framework update
Expert Contributor 5th Oct, 2010 15:48
Score: 2437
Posts: 3,327
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
Last edited on 5th Oct, 2010 16:03
Hello TiMow and Maurice ,

I follow pretty much the same procedures as TiMow :-

I am advised of updates available by M$ and get the yellow shield - sometimes the OSI email update pre-empts M$ - irrespective I go myself to M$updates and custom select .

In this case , I chose all three .Net KB's together and let them run - I too ignore(d) the two 4.0 KB's offered .

In my case the downloads were quick and then the installation of the first one took a very very long time ; the green barred progress bar was stopped but the "|" at the end of the "progress message" message in the display window was still clicking/flickering on and off and the mouse showed occasional action .The next two updates were quicker but still verry slow .

The yellow shield does keep popping up during and after reboot , but in my experience is best totally ignored unless you use it for the complete installation ; again in my experience this way takes even longer but it all happens hidden from view , so it may appeal to some.

I always run Belarc after it has updated to the latest MS Bulletin (sometimes takes 24 hours), even when the PSI and M$ updates agree . It confirms both installation and validation of the hotfixes .

In this case , TiMow , it may be worth seeing what it comes up with :-

http://belarc.com/free_download.html

MY XP shows :KB2416447 for 1.1 in Add/Remove and confirmed by Belarc .
KB2418241 for 2.0 SP2 ------ditto-------
KB2416473 for 3.5 SP1 -------------ditto-----------

Hope this is helpful .

Anthony

PS: re your "auto-update" , you stopped the installation but the KB's were all already downloaded , so some later action - including reboot may well have triggered the remaining 1 and 1/2 updates to complete . See if your M$ "automatic" update settings are still the same .

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+1
-0
mogs RE: Inconclusive .Net Framework update
Expert Contributor 6th Oct, 2010 09:05
Score: 2265
Posts: 6,266
User Since: 22nd Apr 2009
System Score: 100%
Location: UK
Last edited on 6th Oct, 2010 09:07
Morning Maurice.
Just wanted to clarify the issue regarding .NET 4 that you raised....I noted your comment in May:
http://secunia.com/community/forum/thread/show/424...
but in June it came thro' as a Recommended update...for me, using Vista at anyrate.
.NET Framework 4 Client Profile for Vistax86 ( KB982670 ).
Is it possible you could give the reason you think it's not really required by a home user ? Since you reiterated your position concerning it yesterday....it caused me to look back over my updates, as I couldn't remember it being an option not to install.
I've looked again thro' posts/Wikipedia etc., but I can't seem to find anything really conclusive....and what I have found is much too techie for me.
As it came thro' as Recommended I'm loathe to uninstall it....but if as you say; I don't need it;....could it do any harm ?


--
Was this reply relevant?
+1
-0
Maurice Joyce RE: Inconclusive .Net Framework update
Handling Contributor 6th Oct, 2010 10:39
Score: 11726
Posts: 8,970
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@Mogs
The short answer is:

Microsoft created .NET Framework to provide building blocks for applications. .NET is not a component of Windows itself. I strongly recommend that you avoid downloading .NET until you install an application that requires one, at which time the programme will likely install the necessary version for you or notify U that .NET version xxx is required in which case U get it from MS.

Now U have it installed & it is clearly stable I WOULD LEAVE IT ALONE.

As U will have noticed on the Forum there is a "bit of a muddle" going on trying to fix the latest issue.

It is mainly concentrated on XP. It is very difficult to pinpoint the actual problem affecting each individual for various reasons.

1. At one stage XP users were not offered some patches. This was an SP2/SP3 issue.

2. Because of the way MS updates works some users may have installed a .NET Optional Update without the main component being properly installed - drama!

3. They may in the past have used the Windows Clean Up tool (not officially supported by MS anymore for reasons like this)

U will also have noted how it has been fixed in some instances:

1. Luck.
2. The traditional reboot.
3. Ignoring it in the hope it will "go away"!

Although reluctant to advise such action I am slowly coming round to the idea of recommending this course of action to those who have tried everything:

http://blogs.msdn.com/b/astebner/archive/2006/05/3...

In your case ALWAYS complete any action advised by Windows Update & .NET will manage itself.

Hope this helps. If U want more help use email - I do not want to add more drama to a "drama"!!




--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
TiMow RE: Inconclusive .Net Framework update
Dedicated Contributor 7th Oct, 2010 13:35
Score: 737
Posts: 728
User Since: 26th Jun 2009
System Score: N/A
Location: CH
@A.W.

Hi Anthony

Just to respond to your above reply:- interested to learn that you also experienced a slow(er - than considered "normal"), installation. Maybe, I could have been the creator of my own concerns with my .Net installation - although, I still remain pretty convinced there was no sign of life or movement in the installation window for over 5 mins. - next time, I'll do as usual, and go and do something else and only return after about 15 mins.

Finally got around to downloading Belarc (had it mind to do for a long time), which reports all M$ (.Net) as up-to-date - although it did open up another can of worms relating to "CIS Benchmark score" - with all the different entries/considerations with red crosses, I think a perfect 10 is a lot more difficult/time consuming to achieve than a PSI 100%! - something for a rainy day. Interesting to see it working, though (at last).

Just one interesting non-drama with Belarc's reporting of .Net, to note:- I updated .Net on 4th Oct. and Belarc shows the following:

.NET Framework 2.0 Service Pack 2 - KB2418241 on 04/10/2010

.NET Framework 3.5 SP1 - KB2416473 on 04/10/2010

.NETFramework 1.1 - M2416447 on 10/04/2010

all with closed padlocks. The last one is prefixed "M" and not KB, and does this date back to April (not), or just a misprint/Americanisation of the date? - it is the last entry for .Net 1.1 and comes after entries in Aug and Sept.

Regards

TiMow

--
Computing is not yet a perfect science - it still requires humans.
Was this reply relevant?
+0
-0
Anthony Wells RE: Inconclusive .Net Framework update
Expert Contributor 7th Oct, 2010 16:19
Score: 2437
Posts: 3,327
User Since: 19th Dec 2007
System Score: N/A
Location: N/A


Hi TiMow ,

Like I said it was very , very long ; certainly more then 5 mins , but the "|...." in the window was alive - next time go mow the lawn , shovel snow , walk the dog and bath the kids - do not fiddle with M$ when it's dld/inst ing , it's dangerous enuff on it's own .

Unless you upgraded to Pro , then the benchmark does not concern you - if you look closely .

If you have red X 's everywhere , if they are in the hotfix section you need to click the details to the right of the entry and see what is what . Not the place you want to see red . The key to the little icons is lower down .

Read everything and click a few links , like SMART for your HDD health status .

Your non-drama is just that , M and Yank dating are as is .

Take care

Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+1
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability